November 2003 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]syslog-ng 1.6.0rc4 build problems
by David Aldrich 26 Nov '03

26 Nov '03

Hi I have now built syslog-ng 1.6.0rc4 successfully. The key was to build it as root. Perhaps this should be made clear in the installation procedure? Best wishes David Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************

1 0

Preserving syslogd formatting
by Kenneth Gray 26 Nov '03

26 Nov '03

Howdy, I'm using syslog-ng for the first time. I have several scripts that break because the output from the log files created by syslog-ng does not have the hostname bracketed as it does in syslogd. Is there any option to emulate the syslogd formatting? Example: syslog-ng Oct 3 06:29:13 10.11.27.1/10.11.27.1 1164: syslogd Oct 1 22:48:41 [10.11.27.1.218.94] 2354:

2 1

syslog-ng to mysql
by Ali, Tahir 26 Nov '03

26 Nov '03

Hey, I'am running syslog-ng Version: 1.5.15-1. I pipe all the syslog messages to a mysql database. Every thing works fine, but some times it stop logging to the database. I run mysql Version: 3.23.49-8. When i restart syslog-ng it work fine again. It can work fine for weeks. Have any else experience the same problem ? Regards Tahir

2 1

OpenBSD named pipe
by Bobby Johnson 26 Nov '03

26 Nov '03

I'm new to the list, hope this hasn't been covered before. I'm having some problems with syslog-ng, a named pipe and a shell script. I've created a destination in syslog-ng.conf that points to a pipe. In short the shell script looks like this. while read -r line; do sort input and output to file done < named.pipe Almost no matter what I do the script will sit outside the while loop not reading anything as things are input into the pipe. If i echo "anything" > named.pipe the shell script will run through all or most(not absolutly sure on this) of the input and then exit. I have this same setup on a FreeBSD computer and it works great, moved it to OpenBSD and it doesn't. If I do a tail -f on the pipe while my script is running then exit the tail the script works properly. I have tried a few different versions of syslog-ng and libol currently I have 1.6.0rc4 and 0.3.11. I have tried bourne, bash and ksh. Please help. Bobby Johnson Plexus Computer Services www.plexuscomp.com

2 3

Membership?
by David Aldrich 25 Nov '03

25 Nov '03

Hi How can I become a member of this list? (A post I sent yesterday is awaiting approval by the moderator.) Best regards David Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************

1 0

Use_dns(no)
by Jay Davis 25 Nov '03

25 Nov '03

I seem to still be getting hostnames in my messages with this turned on. Am I missing something? I need messages to retain their IP addresses and not get translated to a hostname. I need to get the IP for other information then have an application convert the name. Thanks!!! Please reply to jay_davis(a)fanniemae.com as well as the listserv. Thanks!!!!

2 1

errors on HPUX 11.0 (syslog-ng-1.6.rc4)
by Stephan Hendl 25 Nov '03

25 Nov '03

Hi all, I get the following errors on HPUX11 using syslog-ng-1.6.rc4 What does "...unparseable log message: " mean and how can I solve the problem? My /etc/syslog-ng.conf ion enclosed. Thanks Stephan ------------------ -- root@tc1:/var/adm/syslog> cat messages [2003/11/25 13:29:24] tc1 notice [syslog] syslog-ng[1057]: syslog-ng version 1.6.0rc4 starting [2003/11/25 13:29:25] tc1 notice [daemon] prngd[1083]: prngd 0.9.12 (05 March 2001) started up for user root [2003/11/25 13:29:25] tc1 notice [daemon] prngd[1083]: have 7 out of 60 filedescriptors open Y!åC=>e^a01 01:00:00] tc1 err [syslog] unparseable log message: \"<¿vz?á²ÝªšRª9P3_}£šzL;œ óE2÷ãäáCÆ9J®Sr# ej3\'žpâAßyŽ,YåÄò±Ãs SÒÖqÞyÒâIšüÍ 4¿DåªR [2003/11/25 13:29:28] tc1 info [auth] sshd[1118]: Server listening on 0.0.0.0 port 22. [2003/11/25 13:29:28] tc1 emerg [kern] [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1240]: Setting STREAMS-HEAD high water value to 65536. [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd do_one mpctl succeeded: ncpus = 1. [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd do_one pmap 2 [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd do_one pmap 3 [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd do_one bind 0 [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: Return from t_optmgmt(XTI_DISTRIBUTE) 0 [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1247]: nfsd 0 1 sock 4 [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1248]: nfsd 0 2 sock 4 [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [2003/11/25 13:29:39] tc1 info [daemon] /usr/sbin/nfsd[1241]: nfsd 0 3 sock 4 [1970/01/01 01:00:00] tc1 err [syslog] unparseable log message: \"<h@\" [2003/11/25 13:30:02] tc1 info [auth] sshd[1408]: Accepted publickey for hendl from 10.128.11.71 port 37605 ssh2 ------------------------ root@tc1:/var/adm/syslog> cat /etc/syslog-ng.conf # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe("/dev/log"); internal(); }; destination d_syslog { file("/var/adm/syslog/messages" owner("root") group("root") perm(0644) template( "[$YEAR/$MONTH/$DAY $HOUR:$MIN:$SEC] $HOST $PRIORITY [$FACILITY] $MESSAGE\n")); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/syslog/syslog.log"); }; destination d_mail { file("/var/adm/syslog/mail.log"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(mail) and level(debug); }; filter f_filter2 { level(debug) or level(info) or level(alert) or level(emerg); }; filter f_filter3 { level(alert); }; filter f_filter4 { level(emerg); }; filter f_syslog { not (facility(mail) or facility(user)); }; log { source(s_sys); filter(f_filter1); destination(d_mail); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_cons); destination(d_mlrt); }; log { source(s_sys); filter(f_filter4); destination(d_mlal); }; log { source(s_sys); filter(f_syslog); destination(d_syslog); }; root@tc1:/var/adm/syslog> Stephan Hendl <Stephan.Hendl(a)lds.brandenburg.de>

2 1

syslog-ng 1.6.0rc4 build problems
by David Aldrich 24 Nov '03

24 Nov '03

Hi I am trying to compile syslog-ng 1.6.0rc4 under Redhat Linux. The make is failing because some header files appear to be missing. Please see the make output below. Can you suggest what is wrong please? Best regards David bash-2.05$ pwd /home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4 bash-2.05$ bash-2.05$ make Making all in src make[1]: Entering directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' make all-recursive make[2]: Entering directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' Making all in . make[3]: Entering directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' gcc -DHAVE_CONFIG_H -I. -I/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src -I. -g -O2 -Wall -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory main.c:32:24: pkt_buffer.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/home/daldrich/Downloads/syslog-ng/syslog-ng-1.6.0rc4/src' make: *** [all-recursive] Error 1 bash-2.05$ bash-2.05$ cd src bash-2.05$ bash-2.05$ ls affile.c afremctrl.h afuser.h cfg-lex.l getopt.h Makefile.in strptime.h affile.c.x afsocket.c center.c config.h log.c nscache.c syslog-names.c affile.h afsocket.c.x center.c.x config.h.in log.h nscache.h syslog-names.h afinet.c afsocket.h center.h destinations.c log.h.x snprintf.c syslog-ng.h afinet.c.x afsocket.h.x center.h.x destinations.h macros.c sources.c tests afinter.c afstreams.c cfgfile.c destinations.h.x macros-gperf.c sources.c.x utils.c afinter.h afstreams.c.x cfgfile.h filters.c macros.gprf sources.h utils.h afprogram.c afstreams.h cfgfile.h.x filters.c.x macros.h sources.h.x afprogram.c.x afunix.c cfg-grammar.c filters.h main.c stamp-h afprogram.h afunix.c.x cfg-grammar.h filters.h.x main.c.x stamp-h.in afremctrl.c afuser.c cfg-grammar.y getopt1.c Makefile strcasecmp.c afremctrl.c.x afuser.c.x cfg-lex.c getopt.c Makefile.am strptime.c bash-2.05$ Telecom MODUS is an ISO9001/TickIT approved Company. LRQA Certificate of Approval reference 0965133 ************************************************************ THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVATE AND/OR PROPRIETARY. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please forward the whole message to admin(a)t-modus.nec.co.uk Company Registration No.3493954 Telephone Number +44 (0) 1372 381880 Fax Number +44 (0) 1372 381804 Email general(a)t-modus.nec.co.uk ************************************************************

1 0

Sanity checking
by Carol Overes 21 Nov '03

21 Nov '03

Hi, I'm looking for a way to do some sanity checking on logs messages. My goal is to delete any logmessages which might contain malicious strings or commands like "halt". I'm thinking of using a combination of syslog-ng and logsurfer. However I haven;t have any experience with this combination. Any thoughts or tips about this matter are appreciated. Regards, Carol __________________________________ Do you Yahoo!? Free Pop-Up Blocker - Get it now http://companion.yahoo.com/

2 1

syslog-ng and security
by joop jansen 20 Nov '03

20 Nov '03

Hi, I was wondering if anyone has experience with sanity checking of syslog messages. I'm looking for a manner to filter syslog messages such as: "set passwd ....", which could start commands on a UNIX system. Also, I use a webinterface to view the syslog messages (like the vermeer.org) However I want to filter syslog messages that could exploit browser vulnerabilities. Anyone experience with this or have some good advice ? Thanks in advance for any help. Carol Overes __________________________________ Do you Yahoo!? Protect your identity with Yahoo! Mail AddressGuard http://antispam.yahoo.com/whatsnewfree

5 12